Vulnerability Spotlight: Two vulnerabilities in Epignosis eFront

Summary: Cisco Talos discovered two vulnerabilities in Epignosis eFront LMS: a code execution flaw in v5.2.12 where a crafted web request causes unsafe deserialization that can result in PHP code being executed, and an unauthenticated SQL injection (TALOS-2018-0859/CVE-2019-5070) in versions v5.2.12 and earlier that can be triggered from a browser against the login page with no special tools. Epignosis released eFront version 5.2.13 to address the issues, and Talos published Snort rules 50746 and 50755-50760 to detect exploitation attempts.
What's compelling: The SQL injection sits in the unauthenticated portion of the login page, so anyone who can reach it can attempt data compromise without credentials or tooling, and the code execution flaw runs on the same platform large companies use to train employees.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5070
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026